← Voltar aos guias

API Key Security Workflow for Claude and GPT Apps

Start with a clear key inventory

API key security begins before you write code. Create a simple inventory of every credential your project uses: AI relay keys, database passwords, cloud tokens, webhook secrets, analytics keys, and deployment credentials. For each key, record its owner, environment, purpose, creation date, and rotation date. This makes it much easier to revoke the correct credential when a developer leaves, a laptop is lost, or a repository is accidentally exposed.

For AI applications, keep separate keys for local development, staging, and production. Do not reuse your production key on a personal machine or in a demo project. If you use 59API for low-cost, pay-as-you-go access to Claude models and GPT models, create environment-specific credentials so development experiments cannot affect your production usage or budget.

Keep keys out of source code from day one

The most common API key leak happens when a key is pasted directly into an application file, then committed to Git. Even if you delete it in a later commit, the secret may remain in repository history, cloned copies, build logs, or pull request diffs.

Store local secrets in an environment file such as .env, and add that file to .gitignore before creating it. Your application should read values from environment variables, such as API_KEY and API_BASE_URL. For a 59API integration, configure the base URL as https://api.59api.com and load the API key from the runtime environment rather than hard-coding it into an OpenAI SDK, Claude-compatible client, Codex configuration, or Claude Code setup.

• Commit a .env.example file containing variable names only, never real values.
• Use descriptive names such as 59API_KEY, OPENAI_API_KEY, or ANTHROPIC_API_KEY instead of generic names like SECRET.
• Check configuration files, test fixtures, notebooks, shell history, and sample scripts before pushing.
• Never place a provider key in frontend JavaScript, mobile application code, browser extensions, or public static files.

Use a server-side API boundary

A browser or mobile app cannot reliably protect a secret. Users can inspect network requests, bundled code, device storage, and debugging output. Instead, send requests from your frontend to your own backend endpoint. The backend authenticates the user, applies rate limits and usage policies, then calls the AI provider or relay using the protected server-side key.

This architecture also gives you control over which models and operations each user can access. For example, you can allow standard users to call a lower-cost model, limit high-cost requests to approved workflows, and block unusually large prompts. 59API is useful in this setup because it provides affordable access to native official-quality Claude and GPT models without a downgrade, while remaining compatible with common OpenAI SDK workflows and developer tools.

Add automated leak detection before every deployment

Do not rely on manual review alone. Add secret scanning in three places: your developer machine, your Git host, and your continuous integration pipeline. A pre-commit scanner can stop accidental commits before they leave a laptop. Repository scanning can detect historical exposures and pull-request additions. CI scanning protects branches even when a contributor bypasses local hooks.

Also search your repository periodically for common patterns: API key variable names, long token-like strings, provider hostnames, and old .env backups. Check generated artifacts as well. Deployment bundles, Docker images, log archives, and error-reporting payloads can unintentionally contain credentials. Configure logging to redact Authorization headers, query parameters containing tokens, and environment variables.

Rotate keys and respond quickly to exposure

Treat every suspected leak as real until proven otherwise. If a key appears in a public repository, screenshot, support ticket, CI log, or chat message, revoke or rotate it immediately. Do not wait for evidence of misuse. Then update the secret in your deployment platform, restart affected services, and confirm that the old key no longer works.

• Create a replacement key first so you can update services without unnecessary downtime.
• Deploy the new secret through your secret manager or hosting dashboard, not through source code.
• Revoke the old key after the new deployment is healthy.
• Review usage, request logs, billing activity, and recently deployed commits for suspicious behavior.
• Document the incident and improve the control that failed, such as missing .gitignore rules or inadequate log redaction.

Make secure access part of normal engineering

The goal is not to make AI development slower; it is to make safe behavior the default. Use least-privilege access, separate environments, server-side calls, automated scanning, and scheduled rotation. These habits let your team experiment with Claude, GPT, Claude Code, Codex, and OpenAI-compatible SDKs without turning a convenience shortcut into a costly incident.

If you want an economical relay for those workflows, consider signing up for 59API and configure it through environment variables from the first commit. Its pay-as-you-go pricing, native model access, broad compatibility, and referral rebate can help teams control AI costs while keeping credentials protected.